<?php
###
###- php code:
	/**
	 * 在文件中查找指定的字符串，可用于二进制查找
	 * 使用strpos做对比，没有对\r\n匹配转换
	 *
	 * @param  string $file   文件路径
	 * @param  string $needle 被查找的字符串
	 * @return int/bool       返回offset，没找到返回false
	 */
	function filepos(string $file, string $needle, callable $callback = null)
	{
		$needleLen = strlen($needle);
		$size = intval(1024 * ceil($needleLen / 1024) * 1.5);
		$fp = fopen($file, 'rb');
		$offset = 0;

		$callback = is_callable($callback) ? $callback : function($haystack, $needle) {
			return strpos($haystack, $needle);
		};

		while(!feof($fp)){
			fseek($fp, $offset);
			$data = fread($fp, $size);
			if (($i = $callback($data, $needle)) !== false)
			{
				fclose($fp);
				return $offset + $i;
			}

			$offset += strlen($data) - $needleLen + 1;
		}

		fclose($fp);
		return false;
	}
### exec
	$file = 'D:\program files\Sublime Text 3\sublime_text.exe';
	$pos = filepos($file, "\x45\x8B\xF0\x41\x83\xCE\x04\x38\x5A\x01\x45\x0F\x44\xF0");
	if ($pos !== false)
	{
		$fp = fopen($file, 'cb');
		fseek($fp, $pos);
		fwrite($fp, "\xC6\x02\x01\x41\xBE\x00\x00\x00\x00\x90\x90\x90\x90\x90");
		fclose($fp);
		echo 'hacked!';
	} else {
		echo 'fail.';
	}
	